Beyond the generic “run a scanner” lists — the toolkit built around finding access control and business logic bugs, the kind automated…

This is a long one but it is very important to understand the process of platforms like Hackerone.

Scan a legal practice host for eight specific services, tell a closed port apart from a filtered one, and pull an exact software version…

“With great power comes great vulnerability scanning.”  — Uncle Ben

How a Medium Severity Bug Turned Into a Critical Vulnerability

TL;DR A critical flaw in Forminator Forms puts more than 600,000 WordPress sites at risk. Tracked as CVE-2026-15748, it scores a CVSS 9.8. The bug lets unauthenticated attackers upload executable …

TL;DR GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker …

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a malware-as-a-service tool Target Users lured with a Colombian judicial theme Delivery vector P…

TL;DR BigBlueButton contains a critical path traversal vulnerability within the Etherpad integration. Attackers can perform an unauthenticated arbitrary file read to extract sensitive system files…

Where the news is always bad, but the analysis is always good.

Difficulty: Very Easy

An exceptionally unusual Windows backdoor remained undetected on a single corporate computer for years. Astonishingly, it concealed its command-and-control server address in an incredibly obscure …

The massive American e-commerce corporation, Amazon, recently emailed a critical notification to all active users regarding immediate changes to its terms of service. Specifically, this pivotal mo…

According to Microsoft’s official support documentation, Windows Server 2022 will exit mainstream support in October 2026 and transition into extended support. The operating system, released…

Following rigorous testing across multiple release candidates, developers have officially launched the stable version of Linux Kernel 7.2. You can download the source code directly from the offici…

Mozilla’s open-source Firefox browser has announced that Firefox for iOS is testing a native ad-blocking tool. Users will no longer need to install extensions or third-party utilities to enj…

TL;DR Microsoft patched CVE-2026-66804, an elevation of privilege flaw in the Windows Cross Device Service. A standard local user can gain SYSTEM privileges through a missing-path DLL planting tri…

TL;DR A billing flaw in New API, a popular open-source AI API gateway, is under active attack. Tracked as CVE-2026-71479, this integer overflow lets a user with a small balance credit themselves a…

Hello Everybody, Today in this writeup I am going to explain my findings of a Microsoft’s Important Severity bug which ultimately leads to…

TL;DR A GeoServer unauthenticated SQL injection flaw is under active attack. It lives in the jsonArrayContains filter function against PostGIS layers. Attackers began probing within hours of publi…